Pass the Microsoft Certified: Azure AI Cloud Developer Associate AI-200 Questions and answers with Dumpstech

uthenticate App Service to ACR: assign the registry pull role to a managed identity. Avoid static credentials: configure App Service to use that managed identity for the image pull.

Detailed Explanation: App Service can pull a private image from Azure Container Registry by using a managed identity rather than registry username/password credentials. The identity must be granted an appropriate pull-only registry role at the registry scope, preserving least privilege. A webhook does not authenticate an image pull, and enabling the ACR admin account or storing a registry password would introduce static credentials. The managed-identity approach satisfies both secure authentication and credential-elimination requirements.

Study Guide Alignment: Containerized Azure workloads: registry builds, App Service containers, Container Apps revision/scaling behavior, and AKS deployment choices.

Official Microsoft Learn References: AI-200 Study Guide | Configure a custom container for App Service | Managed identities for Azure resources

Return an immediate response to a client: HTTP trigger

Process background work from a queue: Queue Storage trigger

Run code on a fixed schedule: Timer trigger

Use an HTTP trigger when a function must be invoked by an HTTP request and return a response directly to the calling client. Microsoft documents HTTP triggers as the standard mechanism for building serverless APIs and handling web requests or webhooks. This makes the HTTP trigger the correct fit for synchronous request-response workloads.

For asynchronous background processing, use an Azure Queue Storage trigger . A queue-triggered function runs when messages are added to an Azure Storage queue. This decouples the producer from the consumer and is appropriate for background processing where work can be buffered and processed independently of the original request. Microsoft also documents target-based scaling for Queue Storage triggers on supported Azure Functions hosting plans.

For scheduled execution, use a Timer trigger . Microsoft states that a timer trigger runs a function according to a configured schedule, typically expressed with an NCRONTAB/CRON expression. This makes it the correct choice for periodic maintenance, scheduled synchronization, reporting, or other fixed-time workloads.

Event Grid and Blob Storage triggers are event-driven mechanisms for event notifications and blob changes respectively, but neither matches these three stated dispatching requirements.

Study Guide references: Azure Functions → HTTP triggers; Queue Storage triggers; Timer triggers; event-driven and scheduled execution.

Use the image ' s SHA-256 manifest digest when defining the production deployment. Azure Container Registry assigns every pushed image manifest a unique digest, and Microsoft explicitly states that pulling an image by digest guarantees the image version being retrieved , even if an identically named tag is later pushed to a different image. A digest reference has the form myregistry.azurecr.io/repository@sha256: < digest > .

Tags such as production or latest are mutable references . By default, a user or pipeline with sufficient permissions can push a different image under the same tag. Microsoft therefore warns against relying on reusable stable tags for production deployments when exact image reproducibility is required.

A scheduled rebuild also creates a new image artifact and therefore cannot guarantee that production executes the original build. In contrast, the manifest digest is content-addressed and resolves to the precise image manifest selected at deployment time.

Thus, for deterministic and immutable production image selection, reference the container image by its SHA digest rather than by a mutable tag .

Study Guide references: Azure Container Registry → image manifests and digests; image addressing; tagging/versioning recommendations; immutable deployment references.

Detailed Explanation: For Cosmos DB Always Encrypted, the key hierarchy starts with a customer-managed key held in Azure Key Vault. The data encryption key used by the client is protected by that customer-managed key. Microsoft’s setup sequence therefore begins by preparing Key Vault and the CMK before creating DEKs or an encryption policy. Creating a managed identity, a container policy, or a DEK can be necessary later, but none precedes establishing the CMK that protects the client-side encryption key material.

Study Guide Alignment: AI data-management workloads: Cosmos DB, PostgreSQL, caching, vector storage, vector retrieval, consistency, and connection optimization.

Official Microsoft Learn References: AI-200 Study Guide | Always Encrypted for Azure Cosmos DB

Verified Answer: Read operations: Consistent Prefix. Write operations: Session (the account default remains effective for writes).

Detailed Explanation: Azure Cosmos DB allows a client or request to override consistency for reads. Microsoft explicitly notes that such an override applies only to reads; it does not change how writes are committed and replicated under the account’s configured consistency. Because a new account uses Session consistency by default, requesting Consistent Prefix affects the reads while the account continues to use its Session consistency behavior for writes. This distinction is the key point tested by the hotspot.

Study Guide Alignment: AI data-management workloads: Cosmos DB, PostgreSQL, caching, vector storage, vector retrieval, consistency, and connection optimization.

Official Microsoft Learn References: AI-200 Study Guide | Manage Cosmos DB consistency levels | Cosmos DB consistency level choices

For precise questions over tabular numeric data, convert the workbook data into a structured relational/table representation and expose controlled query functionality to the AI application through function calling. This preserves columns such as quarter, region, revenue, product, and fiscal period as typed fields that can be filtered, aggregated, and compared deterministically. Microsoft demonstrates natural-language-to-SQL patterns in which a user ' s question is translated into a query against structured PostgreSQL data, while Foundry function calling allows a model or agent to invoke application-defined query tools with structured parameters.

This is materially more reliable than embedding spreadsheet rows as unstructured text. Vector search is optimized for semantic similarity , not exact arithmetic, grouping, filtering, or aggregation. A query such as " Q3 revenue for the West region " is fundamentally a structured lookup or aggregation problem. SQL can express those constraints explicitly and return the authoritative numeric result.

Microsoft Foundry also supports agents working with structured data and provides examples where agent tools analyze numeric files and return computed values.

Relying on parametric model knowledge cannot provide current organization-specific financial figures. Azure AI Vision could OCR an image of a spreadsheet, but converting an already structured workbook into an image would destroy useful schema and increase extraction error risk.

Study Guide references: Microsoft Foundry agents; function calling; structured data access; natural-language-to-SQL; grounding AI responses in enterprise data.

===============

Detailed Explanation: An HTTP trigger is the only option that directly accepts a synchronous external request and can return a response immediately to the caller. Azure Functions uses HTTP triggers to implement serverless APIs and webhooks, while Microsoft Entra authentication can be applied to the Function App or API surface. Queue, Event Grid, and Service Bus triggers are asynchronous event-processing mechanisms and do not provide the request/response semantics required by this public API scenario.

Study Guide Alignment: Azure service integration: Service Bus, Event Grid, Azure Functions triggers/bindings, and event-driven processing.

Official Microsoft Learn References: AI-200 Study Guide | Azure Functions HTTP trigger

Detailed Explanation: The original answer omitted the secret-storage requirement. API keys and other secrets should be held in Key Vault, while App Configuration should retain non-secret configuration and Key Vault references. Dynamic refresh is implemented through the App Configuration refresh/polling mechanism rather than requiring an application restart. Managed identity provides credential-free access to both services in Azure. Environment variables do not provide centralized dynamic refresh, and a stored service-principal secret creates exactly the credential-management problem the design is intended to eliminate.

Study Guide Alignment: Security and operations: Key Vault, App Configuration, managed identity, OpenTelemetry, Azure Monitor, and KQL-based troubleshooting.

Official Microsoft Learn References: AI-200 Study Guide | Dynamic configuration in ASP.NET Core | Use Key Vault references in App Configuration | Managed identities for Azure resources